Yrurtj

I am running Apache2 version:

Server version: Apache/2.4.29 (Ubuntu)

Server built:   2018-04-25T11:38:24

I would like to enable TLSv1.3 but I get an error below in Apache2 if I put SSLProtocol TLSv1.2 TLSv1.3 in the ssl.conf file:

# apachectl configtest



AH00526: Syntax error on line 79 of /etc/apache2/mods-enabled/ssl.conf:

SSLProtocol: Illegal protocol 'TLSv1.3'

Action 'configtest' failed.

The Apache error log may have more information.

Is it not possible to enable TLSv1.3 in Apache2 (yet)?

I know Nginx can do it, but this question aims at Apache2.

TLSv1.3 is not yet supported by Apache 2.4.

When it is supported by OpenSSL (see info here), Apache 2.4 should have it too.

TLSv1.3 is now supported in Apache2 version 2.4.36 with OpenSSL 1.1.1 Source.

You might use this PPA:

sudo add-apt-repository ppa:ondrej/apache2

Current version is:

$ apache2 -v



Server version: Apache/2.4.37 (Ubuntu)

Server built:   2018-10-28T15:27:08

TLS 1.3 is supported.

To enable it globally for all VirtualHosts, locate your ssl.conf and set:

SSLProtocol -all +TLSv1.2 +TLSv1.3

Then restart Apache2 and it should be ready for a test, notably it on these sites:

https://www.ssllabs.com/ssltest/

https://www.htbridge.com/ssl/

My example result:

As for TLS 1.3, as was pointed out in this answer, it is still a work in progress, not yet in production in Apache2.

As TLS 1.3 has been finally accepted IETF, it is probably going to production very soon. See their blog for some basic information.

Notes, too long for a comment:

• 
  

  
  

  HTTP SITE DOES NOT REDIRECT

  
  

  
  
  

  The HTTP version of the website does not redirect to the HTTPS version. We advise to enable redirection.

  
  
  

  You can follow this answer on Webmasters. It includes tips for the HSTS Preload list, which after some modifications, you should add the site into.

  
  


• 
  

  Your ciphers are wrong.

  
  
  

  Please use (excerpt from my answer on Webmasters):

  
  
  

  ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA
  
  

  
  
  

  in order to get 95 or 100 % on SSL Labs - Ciper strength score, more info in my answer on Webmasters.

  
  



• You should enable P-384 + P-256, and optionally P-521 curves, as stated in my answer on Webmasters.

TLS 1.1 is no longer mandatory.

• You have omitted TLS 1.1 protocol. It is still mandatory to HIPAA guidance AFAIK, you should consider enabling it for the time being.